CVE-2023-23586
Assigner: Google
Published: 2023-02-17T12:25:35.000Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: kernel
product: Linux Kernel
repo: https://git.kernel.org
vendor: Linux
versions: lessThanOrEqual: 5.10.161
status: affected
version: 5.6
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Bing-Jhong Billy Jheng of Starlabs
datePublic: 2022-12-22T14:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.&nbsp;timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit&nbsp;<a target="_blank" rel="nofollow" href="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&amp;id=788d0824269bef539fe31a785b1517882eafed93">788d0824269bef539fe31a785b1517882eafed93</a></span><br>
value: Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit  788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring 

impacts: capecId: CAPEC-30
descriptions: value: CAPEC-30 Hijacking a Privileged Thread of Execution
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
source: discovery: EXTERNAL
title: Use after free in io_uring in the Linux Kernel
x_generator: engine: Vulnogram 0.1.0-dev